Privacy policy

Last updated: 14 September 2026

In short

Piano Intern loads nothing from external servers. There are no analytics and no tracking services, no advertising, no fonts or maps from third parties and no embedded content. We only set the cookies and the local storage that the service needs to work. That is why there is no cookie banner: there is nothing to consent to.

Controller

Quasda GmbH
Ralf Kramer
Schöne Aussicht 43
45289 Essen
Germany

E-mail: info@piano-intern.de
Legal notice

Overview of the processing

The overview below sums up the types of data we process and the purposes of the processing, and names the persons concerned.

Types of data processed:

• Master data (name)
• Contact data (e-mail address)
• Content data (areas, exercises, planned practice sessions, notes)
• Usage data (pages opened, times of access, the course of a practice session)
• Meta and communication data (IP address, browser identification, time of sign-in)

Special categories of data: we process no special categories of personal data within the meaning of Art. 9 GDPR. The note fields of a practice session are free text; please do not enter anything there that you do not want stored.

Categories of persons concerned: users of the service (people who practise, teachers and their students) and people whom a teacher invites to use the service.

Purposes of the processing:

• Provision of the online service and its functions
• Creation and administration of the user account, sign-in without a password
• Planning, running and evaluation of practice sessions
• Linking teachers and students when both sides want it
• Contact requests and communication
• Security measures and protection against misuse
• Information technology infrastructure

Relevant legal bases

Below you find an overview of the legal bases of the GDPR on which we process personal data. Please note that national data protection rules of your country or ours can apply in addition to the GDPR.

• Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR) – the processing is necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject before entering into a contract. This is the basis for the user account and for every function of the service.
• Legitimate interests (Art. 6(1)(f) GDPR) – the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the interests or fundamental rights and freedoms of the data subject override them. This is the basis for technical operation, logging and protection against misuse.
• Legal obligation (Art. 6(1)(c) GDPR) – the processing is necessary for compliance with a legal obligation to which the controller is subject.
• Consent (Art. 6(1)(a) GDPR) – the data subject has given consent for one or more specific purposes. At present we ask for consent nowhere.

In addition to the GDPR, the national German data protection rules apply, in particular the Federal Data Protection Act (BDSG) and the Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (TDDDG).

Security measures

In line with the legal requirements, and taking into account the state of the art, the cost of implementation and the nature, scope, circumstances and purposes of the processing as well as the different likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These include in particular: encrypted transfer of every page over HTTPS; sign-in through a one-time link of which our database holds only a hash value, so that we store no passwords; separation of the accounts from each other, so that another person's practice data becomes visible only after an invitation that was expressly accepted; limits on the number of requests per minute against automated access; and procedures that ensure the exercise of data subject rights, the deletion of data and a reaction to any threat to the data.

Transfer of personal data

We do not pass personal data to third parties. The exceptions are the operation of the servers and the sending of e-mail: both run through Hetzner Online GmbH, named below, with whom a data processing agreement is in place. A transfer also takes place where the law obliges us to make one.

Within the service, your practice data becomes visible to another person only where a link between a teacher and a student exists that both sides have entered. See “Teachers and students” below.

Processing in third countries

No processing takes place in a third country. The servers and the mailbox are in Germany.

Provision of the online service and hosting

We process the data of users in order to provide them with our online service. For this purpose we process the user's IP address, which is necessary to deliver the content and the functions to the user's browser or device.

• Types of data processed: usage data (pages opened, times of access); meta and communication data (device information, IP addresses).
• Persons concerned: users of the online service.
• Purposes of the processing: provision of our online service; information technology infrastructure; security measures.
• Legal bases: legitimate interests (Art. 6(1)(f) GDPR).

Further notes on processes, procedures and services:

• Hetzner: services in the field of information technology infrastructure and related services (storage space and computing capacity); service provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; legal bases: legitimate interests (Art. 6(1)(f) GDPR); website: https://www.hetzner.com; privacy policy: https://www.hetzner.com/de/rechtliches/datenschutz; data processing agreement: concluded with the provider.
• Collection of access data and log files: access to our online service is recorded in so-called server log files. These can hold the address and name of the pages and files opened, the date and time of access, the amount of data transferred, the message about a successful retrieval, the browser type and version, the user's operating system, the referrer URL and, as a rule, IP addresses and the requesting provider. The log files serve the security and the stability of operation; legal bases: legitimate interests (Art. 6(1)(f) GDPR); deletion of data: log file information is stored for at most 30 days and then deleted. Data that must be kept longer as evidence is exempt from deletion until the incident in question is finally resolved.
• Error logs: if an error occurs in the application, we write a log line with the time, the function concerned and, where you are signed in, the identification number of the account. These logs stay on the server for at most 30 days; legal bases: legitimate interests (Art. 6(1)(f) GDPR).

Cookies and local storage

Cookies are small text files, or comparable records, that store information on devices and read information from them. We use them only to run the service, not for audience measurement and not for advertising.

• Session cookie: keeps you signed in and assigns your requests to your account. Alongside it we store a session record on the server with the time, the IP address and the browser identification of the most recent access, as well as the language you chose last; older values are overwritten. A session stays valid for up to one year, so that you do not have to sign in again and again at the piano. “Sign out” ends it at once.
• CSRF cookie: a random value per session that protects forms against forged requests.
• Local storage in the browser: the timer keeps the state of the running practice session, the events not yet reported and a note on whether we already asked for persistent storage in your browser's storage, so that a lost connection or a reload does not lose the time. Unfinished entries in the session planner are kept in the same way: the draft of a new session is removed after seven days without a change, the draft of an existing session stays until you save or discard it. So that these drafts can be told apart between two open tabs, we keep a random identifier for each tab, which ends when the tab is closed. Finally, we keep the language of the page you opened last, so that the offline page appears in the same language. This data stays on your device; it reaches us only when the timer reports the recorded events to your account.

Note on consent: storing and reading this information is strictly necessary in order to provide you with the service you expressly asked for (§ 25(2) no. 2 TDDDG). Consent is not required for it, and we ask for none. Legal bases: performance of a contract (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

You can delete or block cookies in the settings of your browser. The service then no longer works, because without the session cookie there is no way to sign in.

Registration, sign-in and user account

To use the service you create an account. For this we process your name and your e-mail address as well as your settings for language, time zone and signal sound. We also store when the account was created and when it was last active.

Sign-in without a password: you sign in through a one-time link that we send you by e-mail. We store not the link itself but only its hash value, plus the time it was issued, its expiry and the time it was used. A link is valid for 15 minutes and for a single use. Used and expired links are removed at the latest one day after they expire.

For your session we store the IP address and the browser identification of the most recent access; older values are overwritten. How often an address asks for sign-in links is counted only in the volatile cache of the server and without a permanent record. Both rest on our legitimate interests and those of the users in protection against misuse and other unauthorised use.

An account whose e-mail address was never confirmed through a sign-in link is deleted in full 30 days after registration.

We inform you by e-mail about matters that concern your account: the sign-in link, the confirmation of the registration, an invitation from a teacher and the decision about a request for the teacher role. We send no advertising e-mail.

• Types of data processed: master data (name); contact data (e-mail address); meta and communication data (IP address, times).
• Purposes of the processing: provision of the user account; security measures.
• Legal bases: performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Practice data

The purpose of the service is to plan and record your practice sessions at the piano. For this we process the areas and exercises you create, your planned practice sessions with their entries and time targets, the course of a running session (start, pause, resume, end, the actual duration of each entry), your notes and the statistics and practice streak calculated from them.

This data sits in your account and no other person can reach it as long as you have not entered a link with a teacher.

• Types of data processed: content data; usage data.
• Purposes of the processing: delivery of the agreed service.
• Legal bases: performance of a contract (Art. 6(1)(b) GDPR).

Teachers and students

Anyone who teaches can request the teacher role. We store the request with its time and the decision about it; the review is done by a person we appoint, who sees your name and your e-mail address for that purpose.

A teacher invites students through their e-mail address. For an invitation we store the name the teacher entered, the e-mail address, the hash value of the invitation link and its expiry. An invitation is valid for 14 days; we remove the row at the latest one day after it expires, accepted or not.

If the invited person has no account yet, accepting the invitation creates one: with the name and the e-mail address from the invitation and in the language of the page on which it was accepted. The address counts as confirmed, because only the person who opened the link in the e-mail can get that far. Anyone who does not accept the invitation gets no account.

Once the invitation is accepted, a link comes into being. From then on the teacher can read the archive and the statistics of the student and can assign planned practice sessions to them; an assigned session carries the name of the teacher. The teacher cannot change the data and cannot write notes. In their student list the teacher sees the name and the e-mail address; the other way round, students see only the name of the teacher in their settings. Either side can dissolve the link at any time in the settings; access ends immediately after that. The row about the former link stays, with the time and with which side dissolved it, until one of the two accounts is deleted.

• Types of data processed: master data; contact data; content and usage data of the linked accounts.
• Persons concerned: teachers, students, invited persons.
• Purposes of the processing: delivery of the agreed service; communication.
• Legal bases: performance of a contract (Art. 6(1)(b) GDPR).

Running the service

We run the service and have to protect it against misuse. For that, individual people we appoint have access to an administration view. It lists the accounts with name, e-mail address, role, registration and the time of the last activity, lets us search in them and makes it possible to decide about requests for the teacher role, to withdraw the teacher role and to block or unblock an account. The content of your practice sessions is not part of it; the overview page shows only totals across all accounts. Legal bases: legitimate interests (Art. 6(1)(f) GDPR); performance of a contract (Art. 6(1)(b) GDPR).

Installation as an app

You can put Piano Intern on your home screen, and it then works like an app. For that the browser keeps the files of the interface in its own storage. Nothing is transferred to third parties and no additional account is created; the installation happens on your device alone.

Sending e-mail

To send the e-mails named above we use a mailbox of Hetzner Online GmbH (address as above) as a relay. In doing so, the addresses of the recipients and of the sender as well as the content of the respective e-mails are processed. Please note that e-mail on the internet is generally not sent in encrypted form. As a rule, e-mail is encrypted in transit, but not on the servers from which it is sent and received; we can therefore take no responsibility for the route between our server and your mailbox. Legal bases: performance of a contract (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Contact and request management

When you contact us by e-mail or telephone, we process the details of the person asking as far as this is necessary to answer the request and to take any steps asked for. Legal bases: performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Deletion of data

You can delete your account yourself at any time: in the settings, after entering the confirmation word shown and a fresh sign-in through a sign-in link. The deletion is final and takes your areas, exercises, practice sessions, their entries and events, your notes, your sign-in links and your sessions on every device with it. There is no way to restore it, and your links with teachers or students and the invitations you sent go with it.

If, on the other hand, you delete a single area, exercise, planned session or entry within one, it disappears at once from your view and from every evaluation, but the row stays in the database with a deletion mark. The reason is the readability of the archive: a completed session refers to the exercise and the area under which you practised at the time. These rows disappear for good when your account is deleted.

Sessions that you assigned as a teacher stay as a copy in the account of the student; that copy still carries the name under which the assignment was made. Conversely, when the other account is deleted, your copy loses only the link, not the content.

Apart from that, we delete data in line with the legal requirements as soon as the permission to process it ceases, in particular when the purpose of the processing no longer applies. Where data is not deleted because it is needed for other lawful purposes, its processing is limited to those purposes. This applies, for example, to data that must be kept for commercial or tax law reasons.

The periods named above for the individual processing operations take precedence over this general rule.

Rights of the data subjects

• Right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR.
• Right to withdraw consent: you have the right to withdraw consent you have given at any time.
• Right of access: you have the right to ask for confirmation as to whether data concerning you is processed, and for access to that data as well as further information and a copy of the data in line with the legal requirements.
• Right to rectification: you have the right to ask for the completion of data concerning you or the rectification of inaccurate data concerning you.
• Right to erasure and to restriction of processing: you have the right to ask that data concerning you be erased without delay, or alternatively to ask for a restriction of the processing of the data.
• Right to data portability: you have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to ask for its transfer to another controller.
• Right to lodge a complaint with a supervisory authority: without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany.

An e-mail to info@piano-intern.de is enough for any of these matters.

Changes and updates

Please check the content of this privacy policy from time to time. We adapt it as soon as changes to the processing we carry out make that necessary. We will inform you as soon as a change calls for an action on your part or for another individual notice. Where we give addresses and contact details of companies and organisations, please note that addresses can change over time, and please check them before making contact.

Language

This is a translation for convenience. The German version is the binding one.